CVE-2025-9074 - Docker Remote API (Lab PoC)

⚠️ Disclaimer:
This repository is for educational and research purposes only.
Do not use this code outside of a controlled environment that you own.
The author is not responsible for misuse.

Overview

This repository contains a proof-of-concept (PoC) for CVE-2025-9074, a misconfiguration vulnerability involving the Docker Remote API.
When the Docker daemon was exposed without authentication, an attacker could issue API requests to create and start containers.

This PoC demonstrates the issue in a safe and controlled environment.
Note: This vulnerability has been patched.

Original Write-Up

Credit for the original research and write-up goes to:
🔗 qwertysecurity.com – Blog Post

This repository adapts that work into a Python PoC for easier testing in lab environments.

How it Works

• The script interacts with the Docker Remote API over HTTP.
• It creates a new container with a specified command.
• The container is then started via the API.

The vulnerability existed if the Docker daemon was listening on tcp://0.0.0.0:2375 without TLS or authentication.

Usage

1. Run Docker with the API exposed (lab only)

dockerd -H tcp://0.0.0.0:2375